coinbase-extensions[.]created[.]app

The domain coinbase-extensions.created.app is identified as a brand impersonation threat targeting Coinbase. This domain attempts to deceive users by mimicking the appearance and functionality of the official Coinbase Wallet Extension, potentially leading to credential theft or financial fraud.

Analysis indicates that the domain has a VirusTotal score of 9/95, suggesting that it is recognized by a significant number of security vendors as malicious. The domain is registered through Tucows Domains Inc. and resolves to the IP address 216.150.1.65, which is located in the United States and associated with Amazon.com, Inc. (AS16509). The domain was created on July 12, 2023, and is currently flagged as phishing by Google Safe Browsing. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy.

The current status of coinbase-extensions.created.app is offline, which reduces the immediate risk to users. However, the domain's infrastructure and registration details suggest a well-organized effort to impersonate Coinbase, and it may be reactivated in the future. Users are advised to avoid interacting with this domain and to report any instances of it being active to their cybersecurity teams. Organizations should update their blocklists and continue monitoring for similar domains to prevent potential future attacks.